Changeset 247988e in Klonkt for src/routes/account.js

Timestamp:

06/19/2026 09:55:26 AM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

f33b24a

Parents:

535f955

Message:

feat(auth): admin can link Google and use it to log in

• Account → "Sign in with Google": link/unlink your Google account (/auth/google/link, requireAuth → stores google_sub on own account).
• Google callback: link mode alongside login mode. An admin may log in with Google ONLY if their google_sub is linked and matches (otherwise "Google = never admin" rule holds). Unlinking requires a password (no lockout).
• Admin notice on the login page explains the link route.

Co-Authored-By: Claude <noreply@…>

File:

• src/routes/account.js (modified) (4 diffs)

src/routes/account.js

@@ -24 +24 @@
 import { renderPage } from '../middleware/render.js';
 import { requireAuth } from '../middleware/auth.js';
+import { googleConfigured } from '../config/google.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -58 +59 @@
 router.get('/', requireAuth, (req, res) => {
   const account = db.prepare(`
-    SELECT id, username, email, role, bio, avatar_url, created_at, password_hash
+    SELECT id, username, email, role, bio, avatar_url, created_at, password_hash, google_sub
     FROM users WHERE id = ?
   `).get(req.session.user.id);
   const hasPassword = !!(account && account.password_hash && account.password_hash !== '!google-oauth');
-  if (account) delete account.password_hash; // niet naar de view lekken
+  const googleLinked = !!(account && account.google_sub);
+  if (account) { delete account.password_hash; delete account.google_sub; } // niet naar de view lekken
 
   renderPage(req, res, 'pages/account', {
@@ -69 +71 @@
     account,
     hasPassword,
+    googleLinked,
+    googleAvailable: googleConfigured(),
     editableSite: ownedSite(req.session.user),
     success: req.query.success || null,
@@ -144 +148 @@
 });
 
+// Google-account ontkoppelen. Alleen toegestaan als er nog een wachtwoord is,
+// anders zou je jezelf buitensluiten (geen login-methode meer over).
+router.post('/google/unlink', requireAuth, (req, res) => {
+  const row = db.prepare('SELECT password_hash, google_sub FROM users WHERE id = ?').get(req.session.user.id);
+  if (!row || !row.google_sub) {
+    return res.redirect('/account?error=' + encodeURIComponent('Er is geen Google-account gekoppeld'));
+  }
+  if (!row.password_hash || row.password_hash === '!google-oauth') {
+    return res.redirect('/account?error=' + encodeURIComponent('Stel eerst een wachtwoord in — anders kun je niet meer inloggen.'));
+  }
+  db.prepare('UPDATE users SET google_sub = NULL, updated_at = CURRENT_TIMESTAMP WHERE id = ?').run(req.session.user.id);
+  res.redirect('/account?success=' + encodeURIComponent('Google-account ontkoppeld'));
+});
+
 // ==================== UPLOAD AVATAR ====================
 router.post('/avatar', requireAuth, (req, res) => {